@microsoft/rayfin-auth-provider-fabric 1.24.0 → 1.27.0

package/dist/embeddedFabricLogin.d.ts

@@ -4,11 +4,14 @@ import type { FabricAuthOptions } from './types';
  * Embedded-mode Fabric login — acquires a session via postMessage to the
  * parent Fabric Extension Host without opening a popup.
  *
- * 1. Generates PKCE parameters in local variables (no `localStorage`).
- * 2. Sends `auth.requestHandoff` to the parent via {@link requestHandoff}.
- * 3. Receives the handoff code from the host's `AuthPlugin`.
- * 4. Exchanges the handoff code for tokens via `exchangeVerificationCode`.
- * 5. Creates a session via `createSessionFromTokenResponse`.
+ * 1. Clears any prior Rayfin session in this iframe (`auth.signOut()`)
+ *    so a stale session from a previous Fabric user cannot be reused.
+ * 2. Generates PKCE parameters in local variables (no `localStorage`).
+ * 3. Sends `auth.requestHandoff` to the parent via {@link requestHandoff}.
+ * 4. Receives the handoff code from the host's `AuthPlugin`.
+ * 5. Exchanges the handoff code for tokens via `exchangeVerificationCode`.
+ * 6. Creates a session via `createSessionFromTokenResponse` and marks
+ *    embedded handoff as completed for this page load.
  *
  * The session is stored in the iframe's own `localStorage`.
  *

package/dist/embeddedFabricLogin.js

@@ -1,15 +1,19 @@
 import { generateCodeVerifier, generateCodeChallenge, generateState, } from '@microsoft/rayfin-auth';
 import { AuthError } from '@microsoft/rayfin-lib';
 import { requestHandoff } from './PostMessageAuthTransport';
+import { markEmbeddedHandoffCompleted } from './fabricAuthHelpers';
 /**
  * Embedded-mode Fabric login — acquires a session via postMessage to the
  * parent Fabric Extension Host without opening a popup.
  *
- * 1. Generates PKCE parameters in local variables (no `localStorage`).
- * 2. Sends `auth.requestHandoff` to the parent via {@link requestHandoff}.
- * 3. Receives the handoff code from the host's `AuthPlugin`.
- * 4. Exchanges the handoff code for tokens via `exchangeVerificationCode`.
- * 5. Creates a session via `createSessionFromTokenResponse`.
+ * 1. Clears any prior Rayfin session in this iframe (`auth.signOut()`)
+ *    so a stale session from a previous Fabric user cannot be reused.
+ * 2. Generates PKCE parameters in local variables (no `localStorage`).
+ * 3. Sends `auth.requestHandoff` to the parent via {@link requestHandoff}.
+ * 4. Receives the handoff code from the host's `AuthPlugin`.
+ * 5. Exchanges the handoff code for tokens via `exchangeVerificationCode`.
+ * 6. Creates a session via `createSessionFromTokenResponse` and marks
+ *    embedded handoff as completed for this page load.
  *
  * The session is stored in the iframe's own `localStorage`.
  *
@@ -21,6 +25,23 @@ export async function embeddedFabricLogin(auth, options) {
     if (!options.returnOrigin) {
         throw new AuthError('returnOrigin is required for embedded Fabric authentication.', 'MISSING_RETURN_ORIGIN');
     }
+    // Embedded mode: the parent Fabric host is the source of truth for "who
+    // is signed in".  Discard any prior Rayfin session that may have been
+    // left behind in this iframe's localStorage by a previous Fabric user
+    // BEFORE we ask for a fresh handoff.  Without this, a Fabric user
+    // switch (User A → User B) would leave the SPA authenticated as
+    // User A because tryResumeSession would happily return the stale
+    // User A session and we would never reach the handoff path.
+    //
+    // Errors from signOut are swallowed: the stale token may already be
+    // invalid server-side, and the local clear (which signOut performs in
+    // its own catch block) is what actually matters here.
+    try {
+        await auth.signOut();
+    }
+    catch (signOutError) {
+        console.debug('[FabricAuth:embedded] Pre-handoff signOut failed (non-fatal); local session has been cleared', signOutError);
+    }
     // PKCE in local variables only — not persisted to localStorage.
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = await generateCodeChallenge(codeVerifier);
@@ -50,6 +71,7 @@ export async function embeddedFabricLogin(auth, options) {
         redirectUri,
     });
     auth.createSessionFromTokenResponse(tokenResponse);
+    markEmbeddedHandoffCompleted();
     console.debug('[FabricAuth:embedded] Session established');
 }
 //# sourceMappingURL=embeddedFabricLogin.js.map

package/dist/ensureSignedInWithFabric.d.ts

@@ -6,11 +6,16 @@ import type { FabricAuthOptions } from './types';
  * Implements a multi-step waterfall — the first step that succeeds short-circuits the rest:
  *
  * 1. **Already authenticated** — if `auth.getSession().isAuthenticated` is true,
- *    return the existing session immediately.
+ *    return the existing session immediately.  **Skipped on the first
+ *    embedded call per page load** to avoid silently reusing a stale
+ *    session belonging to a previously signed-in Fabric user.
  * 2. **Refresh token** — if a refresh token is available, attempt `auth.refreshSession()`.
  *    Return the refreshed session on success; continue on failure.
+ *    Also skipped on the first embedded call per page load.
  * 3. **Embedded mode** — if running inside a Fabric iframe (`fabricEmbedded=true`),
  *    use `embeddedFabricLogin()` to acquire a session via `postMessage` handoff.
+ *    `embeddedFabricLogin` performs a hard `auth.signOut()` before the
+ *    handoff so the new session always reflects the current Fabric user.
  * 4. **Open Fabric broker** — no existing auth path available. Open the Fabric Portal
  *    in a new tab via `initiateFabricLogin()` and wait for the Fabric extension to post
  *    the handoff code via `postMessage`. The function exchanges the code internally

package/dist/ensureSignedInWithFabric.js

@@ -1,6 +1,6 @@
 import { AuthError } from '@microsoft/rayfin-lib';
 import { embeddedFabricLogin } from './embeddedFabricLogin';
-import { isEmbeddedMode, tryResumeSession } from './fabricAuthHelpers';
+import { hasEmbeddedHandoffCompleted, isEmbeddedMode, tryResumeSession, } from './fabricAuthHelpers';
 import { initiateFabricLogin } from './initiateFabricLogin';
 /**
  * Ensures the user is signed in via Fabric brokered authentication.
@@ -8,11 +8,16 @@ import { initiateFabricLogin } from './initiateFabricLogin';
  * Implements a multi-step waterfall — the first step that succeeds short-circuits the rest:
  *
  * 1. **Already authenticated** — if `auth.getSession().isAuthenticated` is true,
- *    return the existing session immediately.
+ *    return the existing session immediately.  **Skipped on the first
+ *    embedded call per page load** to avoid silently reusing a stale
+ *    session belonging to a previously signed-in Fabric user.
  * 2. **Refresh token** — if a refresh token is available, attempt `auth.refreshSession()`.
  *    Return the refreshed session on success; continue on failure.
+ *    Also skipped on the first embedded call per page load.
  * 3. **Embedded mode** — if running inside a Fabric iframe (`fabricEmbedded=true`),
  *    use `embeddedFabricLogin()` to acquire a session via `postMessage` handoff.
+ *    `embeddedFabricLogin` performs a hard `auth.signOut()` before the
+ *    handoff so the new session always reflects the current Fabric user.
  * 4. **Open Fabric broker** — no existing auth path available. Open the Fabric Portal
  *    in a new tab via `initiateFabricLogin()` and wait for the Fabric extension to post
  *    the handoff code via `postMessage`. The function exchanges the code internally
@@ -28,13 +33,25 @@ import { initiateFabricLogin } from './initiateFabricLogin';
  * @throws {AuthError} If all steps fail or the broker tab is blocked.
  */
 export async function ensureSignedInWithFabric(auth, options) {
-    // Steps 1-2: existing session or refresh
-    const resumed = await tryResumeSession(auth);
-    if (resumed) {
-        return resumed;
+    // Steps 1-2: existing session or refresh.
+    // In embedded mode we MUST skip this on the first call per page load —
+    // the session in iframe localStorage may belong to a previously
+    // signed-in Fabric user.  After the first successful handoff this load
+    // (`hasEmbeddedHandoffCompleted()` is true) the cached session is the
+    // current user's, so resuming is safe and avoids redundant handoffs.
+    const inEmbeddedMode = isEmbeddedMode(options);
+    const skipResume = inEmbeddedMode && !hasEmbeddedHandoffCompleted();
+    if (!skipResume) {
+        const resumed = await tryResumeSession(auth);
+        if (resumed) {
+            return resumed;
+        }
+    }
+    else {
+        console.debug('[FabricAuth] Embedded mode first load — skipping session resume to avoid stale cross-user session');
     }
     // Step 3: Embedded mode — postMessage auth via parent iframe host
-    if (isEmbeddedMode(options)) {
+    if (inEmbeddedMode) {
         console.debug('[FabricAuth] Embedded mode detected, using postMessage auth');
         try {
             await embeddedFabricLogin(auth, options);

package/dist/fabricAuthHelpers.d.ts

@@ -10,6 +10,24 @@ import type { FabricAuthOptions } from './types';
  * `EmbeddedModeOptions` interface.
  */
 export declare function isEmbeddedMode(options: FabricAuthOptions): boolean;
+/**
+ * Returns whether an embedded postMessage handoff has already completed
+ * during the current page load.
+ */
+export declare function hasEmbeddedHandoffCompleted(): boolean;
+/**
+ * Marks that an embedded postMessage handoff has completed for this page
+ * load.  Subsequent calls to {@link tryResumeSession} will be allowed
+ * (the established session is the current user's session).
+ */
+export declare function markEmbeddedHandoffCompleted(): void;
+/**
+ * Test-only helper that clears the embedded-handoff completion flag.
+ * Not exported from the package barrel.
+ *
+ * @internal
+ */
+export declare function resetEmbeddedHandoffStateForTests(): void;
 /**
  * Attempts to resume an existing session without any user interaction.
  *

package/dist/fabricAuthHelpers.js

@@ -11,6 +11,48 @@ import { isEmbeddedMode as sharedIsEmbeddedMode } from '@microsoft/fabric-embedd
 export function isEmbeddedMode(options) {
     return sharedIsEmbeddedMode(options);
 }
+/**
+ * Module-level flag tracking whether an embedded postMessage handoff has
+ * already completed during the current page load.
+ *
+ * In embedded mode the parent Fabric host is the source of truth for "who
+ * is signed in".  A stale Rayfin session left over from a previous user in
+ * the iframe's `localStorage` must NOT be silently reused — otherwise
+ * switching Fabric users without reloading the iframe leaves the SPA
+ * authenticated as the previous user.
+ *
+ * On the first embedded auth call per page load we therefore skip
+ * {@link tryResumeSession} and run the full sign-out + handoff path
+ * inside {@link embeddedFabricLogin}.  Once that completes we set this
+ * flag so subsequent calls (e.g. additional components asking for the
+ * session) can reuse the freshly established session via
+ * {@link tryResumeSession} without thrashing the postMessage channel.
+ */
+let embeddedHandoffCompletedThisLoad = false;
+/**
+ * Returns whether an embedded postMessage handoff has already completed
+ * during the current page load.
+ */
+export function hasEmbeddedHandoffCompleted() {
+    return embeddedHandoffCompletedThisLoad;
+}
+/**
+ * Marks that an embedded postMessage handoff has completed for this page
+ * load.  Subsequent calls to {@link tryResumeSession} will be allowed
+ * (the established session is the current user's session).
+ */
+export function markEmbeddedHandoffCompleted() {
+    embeddedHandoffCompletedThisLoad = true;
+}
+/**
+ * Test-only helper that clears the embedded-handoff completion flag.
+ * Not exported from the package barrel.
+ *
+ * @internal
+ */
+export function resetEmbeddedHandoffStateForTests() {
+    embeddedHandoffCompletedThisLoad = false;
+}
 /**
  * Attempts to resume an existing session without any user interaction.
  *

package/dist/initEmbeddedAuth.d.ts

@@ -11,11 +11,13 @@ import type { FabricAuthOptions } from './types';
  * **Behaviour:**
  * - If `fabricEmbedded=true` is **not** in the URL and `options.fabricEmbedded`
  *   is not `true`, returns `null` immediately (no-op).
- * - If embedded mode is detected, runs a 3-step waterfall:
- *   1. Return existing session if already authenticated.
- *   2. Attempt refresh via refresh token.
- *   3. Request a handoff code from the parent host via `postMessage`
- *      and exchange it for a session (PKCE, no popup).
+ * - On the first embedded call per page load, skips session resume to
+ *   avoid silently reusing a stale session belonging to a previously
+ *   signed-in Fabric user, and goes straight to the postMessage handoff.
+ *   `embeddedFabricLogin` performs a hard `auth.signOut()` before the
+ *   handoff so the new session always reflects the current Fabric user.
+ * - On subsequent calls within the same page load, runs the standard
+ *   resume waterfall (existing session → refresh token → handoff).
  *
  * Apps that also support the popup flow should continue to call
  * {@link ensureSignedInWithFabric} from a user-gesture handler for the

package/dist/initEmbeddedAuth.js

@@ -1,5 +1,5 @@
 import { embeddedFabricLogin } from './embeddedFabricLogin';
-import { isEmbeddedMode, tryResumeSession } from './fabricAuthHelpers';
+import { hasEmbeddedHandoffCompleted, isEmbeddedMode, tryResumeSession, } from './fabricAuthHelpers';
 /**
  * Initializes embedded Fabric authentication if running inside an iframe
  * with `?fabricEmbedded=true`.
@@ -11,11 +11,13 @@ import { isEmbeddedMode, tryResumeSession } from './fabricAuthHelpers';
  * **Behaviour:**
  * - If `fabricEmbedded=true` is **not** in the URL and `options.fabricEmbedded`
  *   is not `true`, returns `null` immediately (no-op).
- * - If embedded mode is detected, runs a 3-step waterfall:
- *   1. Return existing session if already authenticated.
- *   2. Attempt refresh via refresh token.
- *   3. Request a handoff code from the parent host via `postMessage`
- *      and exchange it for a session (PKCE, no popup).
+ * - On the first embedded call per page load, skips session resume to
+ *   avoid silently reusing a stale session belonging to a previously
+ *   signed-in Fabric user, and goes straight to the postMessage handoff.
+ *   `embeddedFabricLogin` performs a hard `auth.signOut()` before the
+ *   handoff so the new session always reflects the current Fabric user.
+ * - On subsequent calls within the same page load, runs the standard
+ *   resume waterfall (existing session → refresh token → handoff).
  *
  * Apps that also support the popup flow should continue to call
  * {@link ensureSignedInWithFabric} from a user-gesture handler for the
@@ -29,10 +31,20 @@ export async function initEmbeddedAuth(auth, options) {
     if (!isEmbeddedMode(options)) {
         return null;
     }
-    // Steps 1-2: existing session or refresh
-    const resumed = await tryResumeSession(auth);
-    if (resumed) {
-        return resumed;
+    // Steps 1-2: existing session or refresh.
+    // Skip on the first embedded call per page load — a session left in
+    // iframe localStorage may belong to a previously signed-in Fabric
+    // user, and silently resuming it would defeat the handoff.  Once
+    // `embeddedFabricLogin` has succeeded for this load, the cached
+    // session is the current user's and resuming is safe.
+    if (hasEmbeddedHandoffCompleted()) {
+        const resumed = await tryResumeSession(auth);
+        if (resumed) {
+            return resumed;
+        }
+    }
+    else {
+        console.debug('[FabricAuth:initEmbedded] First embedded call this page load — skipping session resume to avoid stale cross-user session');
     }
     // Step 3: postMessage handoff (no popup, no window.open)
     console.debug('[FabricAuth:initEmbedded] Starting postMessage handoff flow');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/rayfin-auth-provider-fabric",
-  "version": "1.24.0",
+  "version": "1.27.0",
   "description": "Fabric brokered authentication provider for Rayfin SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,9 +12,9 @@
   ],
   "type": "module",
   "dependencies": {
-    "@microsoft/rayfin-auth": "1.24.0",
-    "@microsoft/fabric-embedded-host": "1.24.0",
-    "@microsoft/rayfin-lib": "1.24.0"
+    "@microsoft/fabric-embedded-host": "1.27.0",
+    "@microsoft/rayfin-auth": "1.27.0",
+    "@microsoft/rayfin-lib": "1.27.0"
   },
   "devDependencies": {
     "typescript": "^5.8.3",